Recent FAQ Changes

❓ FAQ 1290 New 2014-06-11T00:00:00+00:00

If a merchant uses a service provider to host part or all of their CDE, and the service provider has been validated as PCI DSS compliant, is the merchant's assessor required to go onsite to the third party location and retest the PCI DSS requirements?

PCI SSC does not require that an entity?s assessor go onsite to the entity?s service providers and retest PCI DSS requirements that have already been validated and are covered under …

❓ FAQ 1283 New 2014-06-11T00:00:00+00:00

If a merchant develops an application that runs on a consumer?s device (e.g. smartphone, tablet, or laptop) that is used to accept payment card data, what are the merchant?s obligations regarding PCI DSS and PA-DSS for that application?

If the consumer is also the cardholder and is using the device solely for his/her own cardholder data entry, and the application can only be used by that cardholder using …

❓ FAQ 1284 New 2014-06-11T00:00:00+00:00

Are acquirers considered service providers for the purpose of PCI DSS Requirements 12.8 and 12.9?

Service providers include business entities that are not a payment brand, directly involved in the processing, storage, or transmission of cardholder data on behalf of another entity. This includes organizations …

❓ FAQ 1285 New 2014-06-11T00:00:00+00:00

Does PCI DSS apply to one-time or single-use PANs?

PCI DSS applies to all primary account numbers (PANs) that represent PCI SSC’s founding payment brands (American Express, Discover, JCB, MasterCard, or Visa). Whether a one-time PAN is in scope …

❓ FAQ 1293 New 2014-06-11T00:00:00+00:00

If a merchant?s e-commerce implementation meets the criteria that all elements of payment pages originate from a PCI DSS compliant service provider, is the merchant eligible to complete SAQ A or SAQ A-EP?

To be eligible for SAQ A, all elements of the payment pages must only originate from PCI DSS compliant service provider(s), and no single element of a payment page can …

❓ FAQ 1292 New 2014-06-11T00:00:00+00:00

Why is there a different approach for Direct Post implementations than for iFrame and URL redirect ? what are the technical differences and how do they impact the security of e-commerce transactions?

The way that criminals attempt to hijack card data from e-commerce transactions depends on the way that the merchant’s website accepts cardholder data, the difficulty of gaining access to the …

❓ FAQ 1286 New 2014-06-11T00:00:00+00:00

Does PCI DSS apply to virtual (electronic-only) PANs?

PCI DSS applies to all primary account numbers (PANs) that represent a PCI participating payment card brand (American Express, Discover, JCB, MasterCard, UnionPay, or Visa). This includes PANs that are …

❓ FAQ 1142 Updated 2014-06-11T00:00:00+00:00